[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPGjSc3z05BKdyvkhdqzXUm9Y4Psn1BWjxqjOn4sqy6E":3},{"article":4,"iocs":51,"watch_terms":62,"solutions":63,"lesson":153},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"53f66cf3-3416-4114-8b07-e55d708b35e2","Red Heron Exploits Gitea RCE to Compromise 13 Organizations Across Six Countries","red-heron-exploits-gitea-rce-to-compromise-13-organizations-across-six-countries-09d1dd","A Chinese threat actor tracked as Red Heron has been attributed to the rapid exploitation of a recently disclosed security vulnerability in Gitea to compromise internet-facing instances as part of a multi-national campaign. \"Red Heron scanned 1,386 Gitea instances across seven countries and maintained a separate dataset of 477 Taiwan-based systems,\" Acronis Threat Research Unit (TRU) said in an","A suspected Chinese threat actor, Red Heron, has rapidly exploited a critical Gitea remote code execution vulnerability (CVE-2026-60004) to compromise 13 organizations across six countries. The campaign, which began shortly after the vulnerability's disclosure, involved scanning thousands of Gitea instances and progressed from source-code theft to persistent access, credential collection, and lateral movement, including root-level access to Proxmox clusters. The actor deployed a C++ Linux implant named JITTERLY and a rootkit called SIXZUT to hide their activities.","Red Heron exploits Gitea RCE vulnerability to compromise 13 organizations across six countries.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fred-heron-exploits-gitea-rce-to.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEijvj2lBIP05rWNCbhHf0wzhfJ35HBSL0rrr99VOwBa-AzBrvlz0hpopABC1zCHMLj6mqJTNSiij7cFcocgbHUyRbh1QV3V7OCWDLXn3fJ_fRJQxaj63BC8UOjjNlcBdwZ0jdD3zWDA6XpA3Xt2an-6vAE-kyo3sPOpjNa5tzWnntDxaeia-0zzKa-PuywC\u002Fs1600\u002Fgitea-hacked.jpg","2026-09-14T16:56:30+00:00","2026-09-14T18:00:05.940645+00:00",9,[17,20,23,25],{"name":18,"type":19},"Red Heron","threat_actor",{"name":21,"type":22},"Gitea","product",{"name":24,"type":22},"Proxmox",{"name":26,"type":27},"LD_PRELOAD","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":28,"icon":30,"name":31,"slug":32},null,"Nation-state","nation-state",[34,36,41,46],{"category":35},{"id":28,"icon":30,"name":31,"slug":32},{"category":37},{"id":38,"icon":30,"name":39,"slug":40},"80544778-fabb-4dcd-aa35-17492e5dcf4f","Vulnerabilities","vulnerabilities",{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":30,"name":49,"slug":50},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[52,56,59],{"type":53,"value":54,"context":55},"cve","CVE-2026-60004","Gitea remote code execution vulnerability exploited by Red Heron.",{"type":45,"value":57,"context":58},"JITTERLY","C++ Linux implant used by Red Heron for post-exploitation activities.",{"type":45,"value":60,"context":61},"SIXZUT","LD_PRELOAD rootkit used by Red Heron to hide malicious activity.",[21,24],{"controls":64,"vendors":152},[65,94,123],{"slug":66,"name":67,"problem":68,"products":69},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[70,78,86],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":87,"vendor_name":88,"vendor_logo":89,"product_slug":90,"product_name":91,"url":92,"description":93},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"slug":95,"name":96,"problem":97,"products":98},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[99,107,115],{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":116,"vendor_name":117,"vendor_logo":118,"product_slug":119,"product_name":120,"url":121,"description":122},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","cortex-xdr","Cortex XDR","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fcortex\u002Fcortex-xdr","Endpoint detection and response with extended detection across network, cloud and identity.",{"slug":124,"name":125,"problem":126,"products":127},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[128,136,144],{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":148,"product_name":149,"url":150,"description":151},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[],{"slug":154,"title":155,"body":156,"framework_refs":157,"framework_notes":170},"red-heron-exploits-unpatched-gitea-rce-to-hit-13-orgs-worldwide","Red Heron Exploits Unpatched Gitea RCE to Hit 13 Orgs Worldwide","The Red Heron campaign demonstrates how nation-state actors rapidly weaponize newly disclosed vulnerabilities — in this case, a critical Gitea RCE (CVE-2026-60004) — to achieve broad compromise before organizations can apply patches. The attackers moved swiftly from initial exploitation to source-code theft, credential harvesting, lateral movement, and root-level cluster access, illustrating the cascading damage possible when a single unpatched internet-facing service is exposed. The deployment of a custom Linux implant (JITTERLY) and rootkit (SIXZUT) further highlights how delayed patching grants adversaries time to establish deep, persistent footholds that are difficult to eradicate. Organizations hosting development infrastructure like Gitea publicly must treat critical CVEs as emergency events requiring immediate remediation, not routine patch cycles.",[158,159,160,161,162,163,164,165,166,167,168,169],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST SI-3: Malicious Code Protection","NIST AU-6: Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1190: Exploit Public-Facing Application","MITRE ATT&CK T1068: Exploitation for Privilege Escalation","MITRE ATT&CK T1014: Rootkit","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]